# Famous Chollima (DPRK) npm Supply Chain — Pastebin Text Steganography Dead-Drop Resolver, 17 Malicious Packages, Vercel C2 Infrastructure

> Famous Chollima (DPRK-linked, Contagious Interview cluster) published 17 malicious npm packages (Feb 25-26, 2026) containing an identical obfuscated JavaScript loader that uses a novel text steganography technique to decode C2 URLs from seemingly benign Pastebin posts. The decoded URLs resolve to 32 Vercel-hosted C2 domains with platform-specific payloads (Linux/macOS/Windows). Part of an unusually rapid development pace — two novel loader techniques in one week (Pastebin steganography + Google Drive stager).

- **Published:** 2026-02-27T22:49:00Z
- **Last reviewed:** 2026-02-27T22:49:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0152
- **ID:** TL-2026-0152
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Famous Chollima (also known as the Contagious Interview cluster within the Lazarus Group ecosystem) deployed 17 malicious npm packages between 19:38 UTC on February 25 and 10:35 UTC on February 26, 2026 — a 15-hour burst across 12+ throwaway npm accounts. All packages contain an identical malicious JavaScript file at vendor/scrypt-js/version.js (SHA256: da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4).

The infection chain begins with an npm install script ('node ./scripts/test/install.js') that imports and executes the obfuscated payload. The payload implements a novel text steganography dead-drop resolver: it fetches seemingly benign text from three hardcoded Pastebin URLs (CJ5PrtNk as primary, 0ec7i68M and DjDCxcsT as fallbacks), then applies a custom decoder to extract hidden C2 URLs from specific character positions in the text. The Pastebin posts appear completely innocuous — normal English text with minor 'inexplicable typos' that actually encode the steganographic payload.

All three Pastebin posts decode to the same array of 32 Vercel-hosted domains following a consistent naming pattern: [word]-ext[NNN].vercel.app and [word]-app[NNN].vercel.app (e.g., ext-checkdin.vercel.app, cleverstack-ext301.vercel.app). Only the first domain (ext-checkdin.vercel.app) returns a 200 response, the remaining 31 serve as pre-positioned fallbacks that can be activated if the primary is taken down.

The C2 server delivers platform-specific payloads: Linux receives a bash script via /api/l that downloads tokenlinux.npl (renamed to .sh) to ~/.config/, macOS receives a bash script via /api/m that downloads to ~/Library/, Windows receives a cmd script via /api/w that downloads to %APPDATA%. All payloads execute silently with detached processes. The C2 also implements user-agent filtering — non-curl requests receive a fake 'Permanently suspended' response.

The packages typosquat popular npm libraries: daytonjs (dayjs), corstoken (cors), loadash-lint (lodash), expressjs-lint (express), fastify-lint (fastify), sequelization (sequelize), vitetest-lint (vitest), ether-lint (ethers), among others. The npm accounts use variations of 'christopher.smith', 'andrew.walker', and other Western-sounding names with Gmail addresses.

This campaign occurred alongside another novel technique the same week — Famous Chollima testing Google Drive as a malware stager via express-core-validator. Operator IP tracking via temporary email service OPSEC failures revealed consistent use of Astrill VPN and a Russian TransTeleCom IP (62.33.223.164, geolocated to Moscow), consistent with GitLab's observations of DPRK IT Worker operations.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.007 JavaScript
- T1059.004 Unix Shell
- T1059.003 Windows Command Shell
- T1204.002 Malicious File
- T1546.016 Installer Packages
- T1027.002 Software Packing
- T1027.003 Steganography
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1102.002 Bidirectional Communication
- T1608.001 Upload Malware
- T1583.006 Web Services
- T1586.002 Email Accounts
- T1585.001 Social Media Accounts

## Sources

- [kmsec: Novel DPRK stager using Pastebin and text steganography](https://kmsec.uk/blog/dprk-text-steganography/)
- [kmsec: DPRK tests Google Drive as a malware stager](https://kmsec.uk/blog/dprk-gdrive-stager/)
- [kmsec: Tracking DPRK operator IPs over time](https://kmsec.uk/blog/dprk-opsec-3/)
- [kmsec: DPRK npm tracking dashboard](https://dprk-research.kmsec.uk/)
- [Malpedia: Famous Chollima Pastebin Steganography](https://malpedia.caad.fkie.fraunhofer.de/library/732078c1-2176-4c3a-bcbb-6c38f3436ea5/)
- [GitLab: North Korean adversary operations (operator IP context)](https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/)
- [Open Source Malware: Contagious Interview VS Code Tasks](https://opensourcemalware.com/blog/contagious-interview-vscode)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0152